CVE-2026-118373
Received Received - Intake

LibreSSL ocspcheck Cleartext Transmission Vulnerability

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-118373
EUVD
EUVD-2026-111549

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenBSD LibreSSL 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LibreSSL ocspcheck through version 4.4.0 has a cleartext transmission vulnerability in OCSP requests. The url2host() function discards the OCSP URL scheme, and http_alloc() only selects TLS for port 443. This allows on-path network attackers to read OCSP requests sent to HTTPS responder URLs on non-443 ports, exposing sensitive data like certificate serial numbers, issuer hashes, and nonces.

Detection Guidance

To detect this vulnerability, monitor network traffic for OCSP requests sent to non-standard ports (not 443) over plain HTTP. Use packet capture tools like tcpdump or Wireshark to inspect OCSP traffic for exposed certificate serial numbers, issuer hashes, or nonces. Check if LibreSSL ocspcheck versions up to 4.4.0 are installed on your system.

Impact Analysis

Attackers can intercept OCSP requests sent to HTTPS URLs on non-standard ports, exposing sensitive certificate details. This could lead to privacy breaches, certificate revocation status manipulation, or tracking of certificate usage without detection.

Compliance Impact

This vulnerability may violate GDPR's data protection principles by exposing personal data in transit. For HIPAA, it could compromise the confidentiality of certificate-related information in healthcare systems. Organizations must ensure secure transmission of OCSP requests to maintain compliance.

Mitigation Strategies

Upgrade LibreSSL ocspcheck to a patched version where the url2host() function correctly handles OCSP URL schemes. Alternatively, avoid using non-standard ports for HTTPS OCSP responders until the fix is applied. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart